topic Basic noobie question. in General Topics

Basic noobie question.

mcocat — Wed, 22 Oct 2014 13:00:30 GMT

I am looking to what I would call port address translation, but am unfamiliar with how to do it on the PA. Basically I need a public IP to route SNMP traffic to one inside address, and syslog traffic to another inside address. This will also only apply to a single host from the outside. Can someone give me high level steps to what I need to configure?

Re: Basic noobie question.

reaper — Wed, 22 Oct 2014 13:08:35 GMT

This doc will come in handy Understanding PAN-OS NAT

In short you'd need two nat rules, both from untrust to untrust with the same destination (public) IP but each with it's own destination port and unique destination NAT ip address (see page 21 of the above document)

hope this helps

Re: Basic noobie question.

_slv_ — Wed, 22 Oct 2014 13:22:43 GMT

Hello

You can also find some usefull thing on video turorials Video Link : 1550

Regards

Slawek

Re: Basic noobie question.

ssharma — Wed, 22 Oct 2014 13:36:37 GMT

You Can configure following NAT statements for same public IP:

Untrust to Untrust from any source address to your public ip_1 on 25 then translate to private ip_1 to 25

Untrust to Untrust from any source address to your public ip_1 on 443 then translate to private ip_2 to 4443

Untrust to Untrust from any source address to your public ip_1 on 80 then translate to private ip_3 to 8080

Hope this helps. Thank you.

Re: Basic noobie question.

dreputi — Wed, 22 Oct 2014 13:48:56 GMT

Hello Mcocat,

You can also create a bidirectional NAT rule which looks like this:

The source address being the private IP of the server and translated Ip being the public facing IP. This basically splits the NAT rule internally into two- one for outbound and another for inbound. You can refer to above document given by tpiens to understand this better.

Regards,

Dileep

Re: Basic noobie question.

hshah — Wed, 22 Oct 2014 14:40:25 GMT

Hi Mcocat,

Refer following document that should be enough.

Understanding PAN-OS NAT

Video Link : 1550

NAT Example:

8.8.8.8 - Host on the Internet for which you need NAT to be applicable

1.1.1.1 - Is the Public IP on Untrust

100.1.1.1 - Is the SMTP server on DMZ

SMTP service has TCP port 25 >> Which you need to create

You can repeat the same for other services.

Regars,

Hardik Shah

Re: Basic noobie question.

mcocat — Wed, 22 Oct 2014 14:54:48 GMT

Wow, thank you all for the help with this. I will review the guides and advice and get this completed. I appreciate all of the help!